feat: complete public access rollout with migrations and public corpus promotion

.gitleaksignore

@@ -8,3 +8,5 @@
 # generic-api-key rule on historical commit content scanned in PR history.
 27121756b10df6d93841ebf48b0f1991e0144a1f:data/medications-snapshot.json:generic-api-key:22253
 27121756b10df6d93841ebf48b0f1991e0144a1f:data/medications-snapshot.json:generic-api-key:47690
+b65acddaa13e69e0ad2a49783116056b3a1a3639:data/medications-snapshot.json:generic-api-key:21520
+b65acddaa13e69e0ad2a49783116056b3a1a3639:data/medications-snapshot.json:generic-api-key:46330

package.json

@@ -68,6 +68,8 @@
     "reindex:cleanup-staged": "tsx scripts/cleanup-abandoned-reindex-generations.ts",
     "supabase:recovery-status": "tsx scripts/supabase-recovery-status.ts",
     "promote:query-misses": "tsx scripts/promote-query-misses.ts",
+    "promote:public-documents": "tsx scripts/promote-public-documents.ts",
+    "promote:public-documents:batch": "tsx scripts/promote-public-documents-batch.ts",
     "eval:rag": "node scripts/run-eval-safe.mjs scripts/eval-rag.ts",
     "eval:answer-quality": "node scripts/run-eval-safe.mjs scripts/eval-answer-quality.ts",
     "eval:quality": "node scripts/run-eval-safe.mjs scripts/eval-quality.ts",

scripts/eval-quality.ts

@@ -45,6 +45,7 @@ type EvalQualityArgs = {
   retrievalOnly: boolean;
   ragOnly: boolean;
   skipPreflight: boolean;
+  forceEmbedding: boolean;
 };
 
 export type RagQualityResult = {
@@ -150,6 +151,7 @@ function parseArgs(argv: string[]): EvalQualityArgs {
     retrievalOnly: false,
     ragOnly: false,
     skipPreflight: false,
+    forceEmbedding: false,
   };
 
   for (let index = 0; index < argv.length; index += 1) {
@@ -176,6 +178,10 @@ function parseArgs(argv: string[]): EvalQualityArgs {
       args.skipPreflight = true;
       continue;
     }
+    if (token === "--force-embedding") {
+      args.forceEmbedding = true;
+      continue;
+    }
 
     const value = argv[index + 1];
     if (!value || value.startsWith("--")) throw new Error(`Missing value for ${token}`);
@@ -476,6 +482,11 @@ export function buildEvalQualityReport(args: {
         `retrieval content_recall_at_5 ${retrievalSummary.content_recall_at_5} below ${qualityThresholds.retrievalContentRecallAt5}`,
       );
     }
+    if (retrievalSummary.force_embedding_failure_count > 0) {
+      thresholdFailures.push(
+        `retrieval force_embedding_failure_count ${retrievalSummary.force_embedding_failure_count} above 0`,
+      );
+    }
     if (governance.stale_rate > qualityThresholds.staleTopResultRate) {
       thresholdFailures.push(
         `top-result stale_rate ${governance.stale_rate} above ${qualityThresholds.staleTopResultRate}`,
@@ -664,6 +675,8 @@ ${markdownTable([
 ## Retrieval Decision Metrics
 
 ${markdownTable([
+  ["Force-embedding cases", retrieval.force_embedding_case_count],
+  ["Force-embedding failures", retrieval.force_embedding_failure_count],
   ["Embedding skipped rate", retrieval.embedding_skipped_rate],
   ["Median text candidate budget", retrieval.median_text_candidate_budget],
   ["Second-stage rerank rate", retrieval.second_stage_rerank_rate],
@@ -728,6 +741,7 @@ async function runRetrievalQualityCases(args: {
   ownerId?: string;
   limit?: number;
   query?: string;
+  forceEmbedding?: boolean;
   supabase: Awaited<ReturnType<typeof loadAdminClient>>;
 }) {
   const [{ searchChunksWithTelemetry }, capturedCases] = await Promise.all([
@@ -756,7 +770,7 @@ async function runRetrievalQualityCases(args: {
         topK: retrievalLimitForGoldenCase(testCase),
         minSimilarity: 0.12,
         skipCache: true,
-        forceEmbedding: testCase.forceEmbedding,
+        forceEmbedding: testCase.forceEmbedding || args.forceEmbedding,
       }),
     );
     const latencyMs =

scripts/eval-retrieval.ts

@@ -47,6 +47,7 @@ type EvalArgs = {
 export type GoldenRetrievalResult = {
   id: string;
   query: string;
+  forceEmbedding: boolean;
   expectedQueryClass: string;
   actualQueryClass: string | null;
   expectedDocumentSubstrings: string[];
@@ -516,6 +517,11 @@ export function evaluateGoldenRetrievalCase(args: {
   const tableEvidenceFoundAtK = hasTableEvidence(args.results, topK);
   const actualQueryClass = args.telemetry.query_class ?? null;
   const failures: string[] = [];
+  const vectorLayerCount = Object.entries(args.telemetry.retrieval_layer_counts ?? {}).reduce(
+    (sum, [layer, count]) =>
+      ["embedding_fields", "index_units", "hybrid_vector", "vector_fallback"].includes(layer) ? sum + count : sum,
+    0,
+  );
   const hitAtK =
     documentHitsAtK.missing.length === 0 &&
     contentHitsAtK.missing.length === 0 &&
@@ -533,10 +539,23 @@ export function evaluateGoldenRetrievalCase(args: {
   if (args.testCase.expectTableEvidence && !tableEvidenceFound) {
     failures.push("expected table evidence in top 5");
   }
+  if (args.testCase.forceEmbedding) {
+    if (args.telemetry.embedding_skipped) failures.push("forceEmbedding expected embedding to run");
+    if (args.telemetry.retrieval_strategy === "search_cache") failures.push("forceEmbedding served search cache");
+    if (
+      args.telemetry.retrieval_strategy === "text_fast_path" ||
+      args.telemetry.retrieval_strategy === "document_lookup_fast_path"
+    ) {
+      failures.push(`forceEmbedding returned lexical strategy ${args.telemetry.retrieval_strategy}`);
+    }
+    if (args.telemetry.coverage_gate_decision === "accepted") failures.push("forceEmbedding returned coverage gate");
+    if (vectorLayerCount <= 0) failures.push("forceEmbedding found no vector-layer candidates");
+  }
 
   return {
     id: args.testCase.id,
     query: args.testCase.query,
+    forceEmbedding: args.testCase.forceEmbedding ?? false,
     expectedQueryClass: args.testCase.expectedQueryClass,
     actualQueryClass,
     expectedDocumentSubstrings: args.testCase.expectedDocumentSubstrings,
@@ -612,6 +631,7 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     }
     return counts;
   }, {});
+  const forceEmbeddingResults = results.filter((result) => result.forceEmbedding);
   return {
     case_count: results.length,
     document_recall_at_5: Number(
@@ -647,6 +667,8 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     embedding_skip_reason_counts: embeddingSkipReasonCounts,
     text_fast_path_reason_counts: textFastPathReasonCounts,
     retrieval_layer_counts: layerCounts,
+    force_embedding_case_count: forceEmbeddingResults.length,
+    force_embedding_failure_count: forceEmbeddingResults.filter((result) => result.failures.length > 0).length,
     median_text_candidate_budget: percentile(textCandidateBudgets, 50),
     second_stage_rerank_rate: Number(
       (results.filter((result) => result.secondStageRerankUsed).length / Math.max(results.length, 1)).toFixed(4),
@@ -723,6 +745,8 @@ function printHumanSummary(summary: ReturnType<typeof summarizeGoldenRetrievalRe
   console.log(`  retrieval_strategy_counts=${JSON.stringify(summary.retrieval_strategy_counts)}`);
   console.log(`  retrieval_plan_counts=${JSON.stringify(summary.retrieval_plan_counts)}`);
   console.log(`  retrieval_layer_counts=${JSON.stringify(summary.retrieval_layer_counts)}`);
+  console.log(`  force_embedding_case_count=${summary.force_embedding_case_count}`);
+  console.log(`  force_embedding_failure_count=${summary.force_embedding_failure_count}`);
   console.log(`  embedding_skipped_rate=${summary.embedding_skipped_rate}`);
   console.log(`  embedding_skip_reason_counts=${JSON.stringify(summary.embedding_skip_reason_counts)}`);
   console.log(`  text_fast_path_reason_counts=${JSON.stringify(summary.text_fast_path_reason_counts)}`);

scripts/promote-public-documents-batch.ts

@@ -0,0 +1,68 @@
+import { loadEnvConfig } from "@next/env";
+
+loadEnvConfig(process.cwd());
+
+const BATCH_SIZE = 25;
+
+async function loadAdminClient() {
+  const { createAdminClient } = await import("@/lib/supabase/admin");
+  return createAdminClient();
+}
+
+async function countPublic(supabase: Awaited<ReturnType<typeof loadAdminClient>>) {
+  const { count, error } = await supabase
+    .from("documents")
+    .select("id", { count: "exact", head: true })
+    .eq("status", "indexed")
+    .is("owner_id", null);
+  if (error) throw new Error(error.message);
+  return count ?? 0;
+}
+
+async function fetchBatchIds(supabase: Awaited<ReturnType<typeof loadAdminClient>>) {
+  const { data, error } = await supabase
+    .from("documents")
+    .select("id")
+    .eq("status", "indexed")
+    .not("owner_id", "is", null)
+    .in("metadata->>clinical_validation_status", ["locally_reviewed", "approved"])
+    .limit(BATCH_SIZE);
+  if (error) throw new Error(error.message);
+  return (data ?? []).map((row) => row.id as string);
+}
+
+async function promoteBatch(supabase: Awaited<ReturnType<typeof loadAdminClient>>, ids: string[]) {
+  if (ids.length === 0) return;
+
+  const { error } = await supabase
+    .from("documents")
+    .update({
+      owner_id: null,
+      updated_at: new Date().toISOString(),
+    })
+    .in("id", ids);
+  if (error) throw new Error(error.message);
+}
+
+async function main() {
+  const supabase = await loadAdminClient();
+  let batches = 0;
+
+  while (true) {
+    const ids = await fetchBatchIds(supabase);
+    if (ids.length === 0) break;
+    await promoteBatch(supabase, ids);
+    batches += 1;
+    const publicCount = await countPublic(supabase);
+    console.log(
+      `[public-documents:promote] batch ${batches}: promoted ${ids.length}; public indexed total ${publicCount}`,
+    );
+  }
+
+  console.log(`[public-documents:promote] complete. indexed public documents: ${await countPublic(supabase)}`);
+}
+
+main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

scripts/promote-public-documents.ts

@@ -0,0 +1,80 @@
+import { loadEnvConfig } from "@next/env";
+
+loadEnvConfig(process.cwd());
+
+type PromoteArgs = {
+  ownerId?: string;
+};
+
+async function loadAdminClient() {
+  const { createAdminClient } = await import("@/lib/supabase/admin");
+  return createAdminClient();
+}
+
+function parseArgs(argv: string[]): PromoteArgs {
+  const args: PromoteArgs = {
+    ownerId: process.env.PUBLIC_WORKSPACE_OWNER_ID ?? process.env.LOCAL_NO_AUTH_OWNER_ID,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--owner-id") {
+      args.ownerId = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unknown argument: ${token}`);
+  }
+
+  return args;
+}
+
+async function countCandidates(supabase: Awaited<ReturnType<typeof loadAdminClient>>, ownerId?: string) {
+  let query = supabase
+    .from("documents")
+    .select("id", { count: "exact", head: true })
+    .eq("status", "indexed")
+    .not("owner_id", "is", null)
+    .in("metadata->>clinical_validation_status", ["locally_reviewed", "approved"]);
+
+  if (ownerId) query = query.eq("owner_id", ownerId);
+
+  const { count, error } = await query;
+  if (error) throw new Error(error.message);
+  return count ?? 0;
+}
+
+async function countPublic(supabase: Awaited<ReturnType<typeof loadAdminClient>>) {
+  const { count, error } = await supabase
+    .from("documents")
+    .select("id", { count: "exact", head: true })
+    .eq("status", "indexed")
+    .is("owner_id", null);
+
+  if (error) throw new Error(error.message);
+  return count ?? 0;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const supabase = await loadAdminClient();
+
+  const [candidateCount, publicCount] = await Promise.all([
+    countCandidates(supabase, args.ownerId),
+    countPublic(supabase),
+  ]);
+
+  console.log("[public-documents:promote] indexed public documents:", publicCount);
+  console.log(
+    `[public-documents:promote] pending promotion${args.ownerId ? ` for owner ${args.ownerId}` : ""}:`,
+    candidateCount,
+  );
+  console.log(
+    "Apply migration 20260705220000_promote_locally_reviewed_documents_public.sql with `npx supabase db push --linked`.",
+  );
+}
+
+main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

src/app/api/answer/route.ts

@@ -4,7 +4,11 @@ import { demoAnswer } from "@/lib/demo-data";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { answerQuestionWithScope } from "@/lib/rag";
 import { jsonError, PublicApiError } from "@/lib/http";
-import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
+import {
+  allowRateLimitInMemoryFallbackOnUnavailable,
+  consumeSubjectApiRateLimit,
+  rateLimitJsonResponse,
+} from "@/lib/api-rate-limit";
 import { publicAccessContext } from "@/lib/public-api-access";
 import { classifyRagQuery } from "@/lib/clinical-search";
 import { buildSmartRagApiPlan } from "@/lib/smart-rag-api";
@@ -70,7 +74,7 @@ export async function POST(request: Request) {
       supabase,
       subject: access.rateLimitSubject,
       bucket: "answer",
-      allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
+      allowInMemoryFallbackOnUnavailable: allowRateLimitInMemoryFallbackOnUnavailable(),
     });
     if (rateLimit.limited) {
       return rateLimitJsonResponse("Too many answer requests. Retry shortly.", rateLimit);

src/app/api/answer/stream/route.ts

@@ -2,7 +2,11 @@ import { z } from "zod";
 import { demoAnswer } from "@/lib/demo-data";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { PublicApiError, jsonError } from "@/lib/http";
-import { consumeSubjectApiRateLimit, type ApiRateLimitResult } from "@/lib/api-rate-limit";
+import {
+  allowRateLimitInMemoryFallbackOnUnavailable,
+  consumeSubjectApiRateLimit,
+  type ApiRateLimitResult,
+} from "@/lib/api-rate-limit";
 import { publicAccessContext } from "@/lib/public-api-access";
 import { answerQuestionWithScope, type AnswerProgressEvent } from "@/lib/rag";
 import { classifyRagQuery } from "@/lib/clinical-search";
@@ -232,7 +236,7 @@ export async function POST(request: Request) {
       supabase,
       subject: access.rateLimitSubject,
       bucket: "answer",
-      allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
+      allowInMemoryFallbackOnUnavailable: allowRateLimitInMemoryFallbackOnUnavailable(),
     });
     if (rateLimit.limited) return rateLimitStream(rateLimit);
 

src/app/api/differentials/[slug]/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 
-import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
+import {
+  allowRateLimitInMemoryFallbackOnUnavailable,
+  consumeSubjectApiRateLimit,
+  rateLimitJsonResponse,
+} from "@/lib/api-rate-limit";
 import {
   deriveGovernanceFromSnapshot,
   normalizeDifferentialSlug,
@@ -14,7 +18,7 @@ import { ensureDifferentialsSeeded, loadDifferentialSnapshot } from "@/lib/diffe
 import { getDifferentialRecord, getPresentationWorkflow } from "@/lib/differentials";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
-import { hasPublicApiAuthSignal, publicAccessContext } from "@/lib/public-api-access";
+import { publicAccessContext, shouldResolvePublicCatalogAccess } from "@/lib/public-api-access";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
 import { parseRequestQuery } from "@/lib/validation/query";
@@ -63,7 +67,7 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
       });
     }
 
-    if (!hasPublicApiAuthSignal(request)) {
+    if (!shouldResolvePublicCatalogAccess(request)) {
       const snapshot = loadDifferentialSnapshot();
       const governance = deriveGovernanceFromSnapshot(snapshot);
       if (kind === "presentation") {
@@ -91,7 +95,7 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
       supabase,
       subject: access.rateLimitSubject,
       bucket: "registry",
-      allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
+      allowInMemoryFallbackOnUnavailable: allowRateLimitInMemoryFallbackOnUnavailable(),
     });
     if (rateLimit.limited) {
       return rateLimitJsonResponse("Differential requests are rate limited. Try again shortly.", rateLimit);